Auth intro

Guards concept

A guard defines how Laravel finds the current visitor on each request. One application can run several guards side by side, for example a web guard for browsers and a token guard for an API.

The Auth facade always talks to the default guard unless the guard method names another one explicitly.

use Illuminate\Support\Facades\Auth; $guard = Auth::guard("web"); $user = $guard->user();

Session guard

The session guard keeps the login state in a cookie backed session. After login it stores the user id, and on every later request it loads the user from that id.

Nothing about passwords lives in the session itself, only the id that points back to the users table.

use Illuminate\Support\Facades\Auth; $user = Auth::user(); $id = Auth::id();

Hash passwords

Passwords are never stored as plain text. The Hash facade turns a password into a one way hash when the account is created, and it verifies a login attempt against that hash later.

Each call produces a different string for the same password, so stolen hashes cannot be compared by eye.

use Illuminate\Support\Facades\Hash; $hash = Hash::make("secret123"); $ok = Hash::check("secret123", $hash);

Auth::check

Controllers and templates ask the Auth facade whether a visitor is logged in right now. The check method answers true for logged in visitors and false for everyone else.

Use the result to show login links to guests and account links to members, or to block actions that need an account.

use Illuminate\Support\Facades\Auth; if (Auth::check()) { echo "Welcome back"; } if (Auth::guest()) { echo "Please log in"; }

Next: Hand-rolled login

Article author: Arthur Isaev